No. 1Security
Developers ask whether Zod 4.6.6 was hit by malware
A Hacker News thread asks whether version 4.6.6 of Zod was compromised with malware. The source material is only the thread title, with no write-up behind it. It doesn't say what the malicious code might do, how anyone spotted it, or whether a fixed release exists. Treat it as an unconfirmed report, not a verified incident. The maintainers' response and any security advisory are what to watch today.
Why it mattersYou should check whether your projects pull in Zod 4.6.6 and hold off on updating until the claim is confirmed or dismissed.
Full story at Hacker News →No. 2Privacy
Fingerprinting is replacing cookies as the way sites track you
An essay argues that device fingerprinting now does the job third-party cookies used to do. A site can combine what your browser sends, such as its language, OS and IP address, with hardware measurements taken by running code, like GPU, CPU threads, memory and screen details. No permission prompt is involved. Each trait is common alone, but together they can single out one device. The author notes that ZIP code, birth date and sex together identify over 60% of Americans. Brave adds random noise to scramble the readings, while Tor and Mullvad make every user look identical. The author also says Google dropped its plan to kill cookies and now allows fingerprinting in its ad products.
Why it mattersYou should know that clearing cookies or using incognito mode won't stop this kind of tracking, and that only a few browsers actively fight it.
Full story at Hacker News →No. 3Surveillance
Flock wouldn't remove its cameras from an Illinois college
Elgin Community College had six Flock cameras installed in April 2025. By September, administrators worried that Flock was sharing data with Customs and Border Patrol, that feeds weren't secure, and that police and company staff were abusing access. In October the college asked for the cameras to be removed, and Flock said it hadn't broken the contract. In December the college offered to pay out the remaining five months and got no reply. Staff covered the cameras with trash bags, and workers in an unmarked vehicle kept removing the covers. The cameras only came down in April, when the contract expired.
Why it mattersYou should see how hard it can be to end a surveillance contract, even for an institution that wants out and offers to pay.
Full story at The Verge →